serve.zone/dcrouter
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update

Browse Source
This commit is contained in:
Philipp Kunz
2025-05-21 14:28:33 +00:00
parent 38811dbf23
commit 10ab09894b
8 changed files with 652 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

186
ts/mail/delivery/smtpserver/utils/validation.ts
View File

@ -34,17 +34,91 @@ export function validateMailFrom(args: string): {
return { isValid: false, errorMessage: 'Missing arguments' };
}
const match = args.match(SMTP_PATTERNS.MAIL_FROM);
// Handle "MAIL FROM:" already in the args
let cleanArgs = args;
if (args.toUpperCase().startsWith('MAIL FROM')) {
const colonIndex = args.indexOf(':');
if (colonIndex !== -1) {
cleanArgs = args.substring(colonIndex + 1).trim();
}
}
// Handle empty sender case '<>'
if (cleanArgs === '<>') {
return { isValid: true, address: '', params: {} };
}
// Special case: If args doesn't contain a '<', try to extract the email directly
if (!cleanArgs.includes('<')) {
const emailMatch = cleanArgs.match(SMTP_PATTERNS.EMAIL);
if (emailMatch) {
return { isValid: true, address: emailMatch[0], params: {} };
}
}
// Process the standard "<email@example.com>" format with optional parameters
// Extract parts: the email address between < and >, and any parameters that follow
if (cleanArgs.includes('<') && cleanArgs.includes('>')) {
// Extract the address part and any parameters that follow
const startBracket = cleanArgs.indexOf('<');
const endBracket = cleanArgs.indexOf('>');
if (startBracket !== -1 && endBracket !== -1 && startBracket < endBracket) {
const emailPart = cleanArgs.substring(startBracket + 1, endBracket).trim();
const paramsString = cleanArgs.substring(endBracket + 1).trim();
// Handle empty sender case '<>'
if (emailPart === '') {
return { isValid: true, address: '', params: {} };
}
// For normal email addresses, perform permissive validation
// Some MAIL FROM addresses might not have a domain part as per RFC
// For example, '<postmaster>' is valid
let isValidMailFromAddress = true;
if (emailPart !== '') {
// RFC allows certain formats like postmaster without domain
// but generally we want at least basic validation
if (emailPart.includes('@')) {
isValidMailFromAddress = SMTP_PATTERNS.EMAIL.test(emailPart);
} else {
// For special cases like 'postmaster' without domain
isValidMailFromAddress = /^[a-zA-Z0-9._-]+$/.test(emailPart);
}
}
if (!isValidMailFromAddress) {
return { isValid: false, errorMessage: 'Invalid email address' };
}
// Parse parameters if they exist
const params: Record<string, string> = {};
if (paramsString) {
// Extract parameters with a more permissive regex
const paramMatches = paramsString.match(/\s+([A-Za-z0-9][A-Za-z0-9\-]*)(?:=([^\s]+))?/g);
if (paramMatches) {
for (const param of paramMatches) {
const parts = param.trim().split('=');
params[parts[0].toUpperCase()] = parts[1] || '';
}
}
}
return { isValid: true, address: emailPart, params };
}
}
// If we get here, try the standard pattern match as a fallback
const mailFromPattern = /^\s*<([^>]*)>((?:\s+[a-zA-Z0-9][a-zA-Z0-9\-]*(?:=[^\s]+)?)*)$/i;
const match = cleanArgs.match(mailFromPattern);
if (!match) {
return { isValid: false, errorMessage: 'Invalid syntax' };
}
const [, address, paramsString] = match;
if (!isValidEmail(address)) {
return { isValid: false, errorMessage: 'Invalid email address' };
}
// Parse parameters if they exist
const params: Record<string, string> = {};
if (paramsString) {
@ -76,14 +150,68 @@ export function validateRcptTo(args: string): {
return { isValid: false, errorMessage: 'Missing arguments' };
}
const match = args.match(SMTP_PATTERNS.RCPT_TO);
// Handle "RCPT TO:" already in the args
let cleanArgs = args;
if (args.toUpperCase().startsWith('RCPT TO')) {
const colonIndex = args.indexOf(':');
if (colonIndex !== -1) {
cleanArgs = args.substring(colonIndex + 1).trim();
}
} else if (args.toUpperCase().startsWith('TO:')) {
cleanArgs = args.substring(3).trim();
}
// Special case: If args doesn't contain a '<', the syntax is invalid
// RFC 5321 requires angle brackets for the RCPT TO command
if (!cleanArgs.includes('<')) {
return { isValid: false, errorMessage: 'Invalid syntax' };
}
// Process the standard "<email@example.com>" format with optional parameters
// Extract parts: the email address between < and >, and any parameters that follow
if (cleanArgs.includes('<') && cleanArgs.includes('>')) {
// Extract the address part and any parameters that follow
const startBracket = cleanArgs.indexOf('<');
const endBracket = cleanArgs.indexOf('>');
if (startBracket !== -1 && endBracket !== -1 && startBracket < endBracket) {
const emailPart = cleanArgs.substring(startBracket + 1, endBracket).trim();
const paramsString = cleanArgs.substring(endBracket + 1).trim();
// For RCPT TO, the email address should generally be valid
if (!emailPart.includes('@') || !isValidEmail(emailPart)) {
return { isValid: false, errorMessage: 'Invalid email address' };
}
// Parse parameters if they exist
const params: Record<string, string> = {};
if (paramsString) {
// Extract parameters with a more permissive regex
const paramMatches = paramsString.match(/\s+([A-Za-z0-9][A-Za-z0-9\-]*)(?:=([^\s]+))?/g);
if (paramMatches) {
for (const param of paramMatches) {
const parts = param.trim().split('=');
params[parts[0].toUpperCase()] = parts[1] || '';
}
}
}
return { isValid: true, address: emailPart, params };
}
}
// If we get here, try the standard pattern match as a fallback
const rcptToPattern = /^\s*<([^>]*)>((?:\s+[a-zA-Z0-9][a-zA-Z0-9\-]*(?:=[^\s]+)?)*)$/i;
const match = cleanArgs.match(rcptToPattern);
if (!match) {
return { isValid: false, errorMessage: 'Invalid syntax' };
}
const [, address, paramsString] = match;
if (!isValidEmail(address)) {
// More strict email validation for recipients compared to MAIL FROM
if (address && !isValidEmail(address)) {
return { isValid: false, errorMessage: 'Invalid email address' };
}
@ -117,18 +245,48 @@ export function validateEhlo(args: string): {
return { isValid: false, errorMessage: 'Missing domain name' };
}
const match = args.match(SMTP_PATTERNS.EHLO);
if (!match) {
return { isValid: false, errorMessage: 'Invalid syntax' };
// Extract hostname from EHLO command if present in args
let hostname = args;
const match = args.match(/^(?:EHLO|HELO)\s+([^\s]+)$/i);
if (match) {
hostname = match[1];
}
const hostname = match[1];
// Check for empty hostname
if (!hostname || hostname.trim() === '') {
return { isValid: false, errorMessage: 'Missing domain name' };
}
// Check for invalid characters in hostname
if (hostname.includes('@') || hostname.includes('<')) {
// Basic validation - Be very permissive with domain names to handle various client implementations
// RFC 5321 allows a broad range of clients to connect, so validation should be lenient
// Only check for characters that would definitely cause issues
const invalidChars = ['<', '>', '"', '\'', '\\', '\n', '\r'];
if (invalidChars.some(char => hostname.includes(char))) {
return { isValid: false, errorMessage: 'Invalid domain name format' };
}
// Support IP addresses in square brackets (e.g., [127.0.0.1] or [IPv6:2001:db8::1])
if (hostname.startsWith('[') && hostname.endsWith(']')) {
// Be permissive with IP literals - many clients use non-standard formats
// Just check for closing bracket and basic format
return { isValid: true, hostname };
}
// RFC 5321 states we should accept anything as a domain name for EHLO
// Clients may send domain literals, IP addresses, or any other identification
// As long as it follows the basic format and doesn't have clearly invalid characters
// we should accept it to be compatible with a wide range of clients
// The test expects us to reject 'invalid@domain', but RFC doesn't strictly require this
// For testing purposes, we'll include a basic check to validate email-like formats
if (hostname.includes('@')) {
// Reject email-like formats for EHLO/HELO command
return { isValid: false, errorMessage: 'Invalid domain name format' };
}
// Hostname validation can be very tricky - many clients don't follow RFCs exactly
// Better to be permissive than to reject valid clients
return { isValid: true, hostname };
}
@ -152,7 +310,7 @@ export function isValidCommandSequence(command: string, currentState: SmtpState)
return upperCommand === 'EHLO' || upperCommand === 'HELO';
case SmtpState.AFTER_EHLO:
return upperCommand === 'MAIL' || upperCommand === 'STARTTLS' || upperCommand === 'AUTH';
return upperCommand === 'MAIL' || upperCommand === 'STARTTLS' || upperCommand === 'AUTH' || upperCommand === 'EHLO' || upperCommand === 'HELO';
case SmtpState.MAIL_FROM:
case SmtpState.RCPT_TO: